Policy workload-kv-read-keycape-forgejo-eso and Kubernetes role
external-secrets-keycape-forgejo applied 2026-10-09T18:09Z. Inert until
mint-secret creates platform/workloads/keycape/forgejo (RPF-WP-0054).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
From ops-mason SecurityCase forgejo-netkingdom-oidc (MASON-WP-0010-T03, render
sha256:fb8b114d...). Policies regenerated from the CCRs: the case render
omitted the lookup-self/revoke-self stanzas that token_self_lifecycle
requires. CCR-0042 stays in_flight until railiance-apps binds forgejo's reader.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9